GINC-APT-0218 · State

LightBasin

Also CL-CRI-0025, DecisiveArchitect, Luminal Panda, TH-239, UNC1945.

Category
State · Attributed to a state or working for one.
Origin
China(high confidence)
Motivation
Information theft and espionage
Seen
2016
Sources
7 sources carry it
Identifier
GINC-APT-0218 · lightbasin

What it is

UNC1945 is an APT group that has been targeting telecommunications companies globally. They use Linux-based implants to maintain long-term access in compromised networks. UNC1945 has demonstrated advanced technical abilities, utilizing various tools and techniques to evade detection and move laterally through networks. They have also been observed targeting other industries, such as financial and professional consulting, and have been linked to other threat actors, including MustangPanada and RedDelta.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

CrowdStrike
Luminal Panda
Mandiant
UNC1945
Other names
CL-CRI-0025, DecisiveArchitect, TH-239

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Targets

Sectors
Financial, IT, Telecommunications

Tools

The tools and malware families the sources tie to it.

  • CordScan
  • Evilsun
  • FRP
  • Impacket
  • Lemonstick
  • Living off the Land
  • Logbleach
  • Oksolo
  • Openshackle
  • PingPong
  • ProxyChains
  • Pupyrat
  • QEMU
  • SIGTRANslator
  • SMBExec
  • Slapstick
  • Steelcorgi
  • Tinyshell

Sources